Method and apparatus for transmitting route data captured by a travelling vehicle to a central database while better protecting privacy

ABSTRACT

A method for transmitting route data captured by a traveling vehicle to a database arranged separately from the vehicle comprises capturing at least a first number of route data records. A route data record in this context comprises route data and also a location and a time of capture. The captured route data records are stored in a memory of the vehicle. When at least the first number of route data records is available in the memory, route data messages are sent to the database. A route data message in this context comprises route data and an associated location of capture. A route data message is sent at a time randomly selected within a first time interval after the capture of the route data and/or when the vehicle has left a predetermined radius around the location of capture of the route data. The messages can be sent directly to the database, or via a minimum number of intermediate receivers posing as the origin of the data to the respective receiver of a transmission from them.

BACKGROUND Field of the Art

The present invention relates to the capture of route data by sensors ofa vehicle and transmission of the captured route data to avehicle-external database.

Prior Art

In order to keep data pertaining to route properties in a database, forexample for autonomous or semiautonomous driving, relevant, the dataneed to be regularly brought up to date. Capture of the route propertiescan be performed by vehicles traveling on the roads that are eachequipped with suitable sensors and an apparatus for capturing thegeo-position. The captured data can then be sent via a vehicle-to-Xcommunication or a mobile radio connection to a database, where they areconsolidated to produce a data record that can then be sent to othervehicles, e.g. for a route calculation or the like.

Many vehicle users have reservations that capture of the position duringthe journey can be used to create a profile, and are therefore notavailable for the capture of data.

BRIEF SUMMARY

It is an object to improve the privacy of vehicle users when forwardingroute properties captured during the journey to a central database.

This object is achieved by the method specified in claim 1. Advantageousrefinements and further developments of the method are specified in thedependent claims.

Explanations of Terms

Within the context of the present description, the term route datarelates to data describing properties of a route at a location at thetime of capture. Properties of a route comprise, inter alia, a gradient,a lateral incline, or a surface condition of a road on the route, e.g.roughness of the road surface or ruts, or else traffic restrictionsindicated by road signs, times at which traffic restrictions indicatedby road signs apply, the site of a road sign, temporary orlonger-lasting traffic disruptions, e.g. as a result of accidents orbroken down vehicles or shed loads, a traffic density, and the like. Alocation, or capture location, at which a route property has beencaptured may be a geo-position, as used in navigation systems, or aposition on a map used by a navigation system, or the like, for example.A route data record is accordingly a data record combining at least oneroute property and the associated location of capture. The term routedata messages relates to data messages sent to a vehicle-externaldatabase. They comprise route data and a location at which the routedata have been captured, inter alia. The location of capture may also bea route section determined by geo-positions for a start and an end, orby an intermediate geo-position and an extent in both directions oftravel on the route. The location of capture can also include adirection of travel on the route section, e.g. in order to moreaccurately capture a route property available only for one direction oftravel.

According to one aspect of the method according to the invention, routedata and associated locations are captured by a traveling vehicle, andare stored together with a time of capture in a memory of the vehicle.The route data in this context can be captured by one or more sensorsprovided on or in the vehicle. The storage can be effected in aseparate, secure or encrypted area of the memory.

For the purpose of capturing route data according to this and otheraspects of the present invention, sensors that can also be used forother functions are provided in the vehicle. As such, by way of example,a camera for road sign recognition or for a lane departure warningsystem, a distance radar, a lidar system for automated driving, a rainsensor or a temperature sensor, which are provided in the vehicleanyway, can also be used for capturing route properties. The temperaturesensor in this context would provide, by way of example, routeproperties having a shorter validity period, such as, for example,temperatures close to the road surface, which are evaluated to warnabout icy roads for sections of the route. Sensors providing informationabout dynamic movements of the wheel suspensions, for example for adynamically controlled chassis, can provide data pertaining to thecondition of the surface, e.g. bumps or ruts. Data from ABS systems andtraction control systems can also provide information about propertiesof the route surface, e.g. about a coefficient of friction, which may bedifferent depending on weather conditions. Weather conditions can becaptured by a rain sensor, for example, or by monitoring the operationof a windshield wiper by a driver. Gyrosensors or acceleration sensorsof a vehicle stabilization system can provide information pertaining togradient or lateral incline of the route. Specific sensors can beadditionally provided for capturing other route properties.

Route data messages comprising route data and a respectively associatedlocation of capture are sent to the database after the vehicle has lefta predetermined radius around the capture location, i.e. there is aparticular distance between the vehicle and the capture location, and/orat a randomly chosen time within a predetermined time interval after thetime of capture. The predetermined time interval and/or thepredetermined radius may be user-defined, e.g. as a result of selectionof one of multiple values of a parameter that represent different gradesof the protection of privacy by a user. The predetermined time intervalcan begin immediately upon or after the capture, but it is also possibleto have the predetermined time interval begin only after a waiting timehas elapsed after the capture, or after the predetermined radius aroundthe capture location has been left. It is also possible to determine, inaddition to the predetermined radius indicating an absolute distancefrom the capture location, another radius, from which, when it is left,the predetermined time interval begins. The messages are thus notnecessarily sent immediately after the predetermined radius is left.

The predetermined period can also be adapted dynamically on the basis ofa distance covered since the time of capture, and the predeterminedradius can be dynamically adapted on the basis of an average speedaround the time of capture. The predetermined radius can also bestipulated on the basis of a minimum number of road junctions within theradius, which hampers ascertainment of a probable itinerary.

When the vehicle follows a route planned by means of a navigationsystem, the predetermined period and/or the radius may also be dependenton the length of the route, and/or on an average speed ascertainedbefore capture.

In the case of one aspect of the method according to the invention, ifthe predetermined radius is chosen to be relatively large, for examplecomprises a larger part of a city, and is possibly not left, the routedata captured during a journey can be transmitted after the journey hasended. Such a situation can arise, by way of example, when a relativelylarge radius around a home location from which journeys are begunfrequently or regularly is rarely left. To nevertheless hamper thereconstruction of a route traveled during a journey, the route datamessages can be sent in succession within a time interval after thejourney has ended. In this case, the individual route data messages canbe sent in a random order, independent of the chronological order oftheir capture, and also at random intervals from one another.

If the type of route data allows a reconstruction of the direction oftravel and, as a result, a reconstruction of a single journey, forexample road signs, the content of which can usually be seen only fromone side, then sending can be delayed until a minimum number of furtherjourneys have been made. It is also conceivable for further journeysapplicable to the present method to be only those for which at least asubsection differs from previously traveled itineraries. In this case,repeatedly captured route properties that have not changed over themultiple journeys can be sent only a single time. Alternatively, theremay be provision for route data facilitating a reconstruction of theitinerary not to be transmitted.

Fundamentally, when multiple route data records for which respectiveconditions for sending to the database are satisfied are stored in thevehicle, a first order for sending the applicable route data messagescan be chosen for different aspects of the present method. The firstorder may be a random order independent of the chronological order ofcapture. This can hamper the ascertainment of a direction of travel inwhich the journey has been made. In this case, random intervals of timecan be inserted between individual route data messages. It is naturallyalso possible to send the data in the order in which they are captured.

According to one aspect of the method according to the invention, theroute data to be transmitted to the database can be selected such thatonly data pertaining to chronologically invariable or only slowlyvariable route properties are transmitted, in order to hamper theascertainment of a driving profile by means of a correlation withapplicable data from other vehicles.

According to one aspect of the method according to the invention, aperiod within which the route data have been captured is alsotransmitted in a route data message. As a result, a decision can be madein the database regarding whether the received data are rejected orstored. This aspect may be useful when different settings for protectingprivacy in different vehicles lead to route data for a location thatrelate to relatively quickly variable route properties arriving at thedatabase in a manner distributed over a longer period. The route datacaptured during an earlier period, that is to say older route data,which differ from newer route data, captured during a later period, canthen be rejected. The period can be chosen such that ascertainment of anitinerary is hampered. As such, by way of example, the period may bechosen such that it comprises multiple successive single journeys.

According to one aspect of the method according to the invention, thepredetermined radius and/or the predetermined time interval aredependent on the urgency of the transmission of the data. As such, fordata relating to route properties whose fast transmission and furtherdissemination may be of benefit to other road users, e.g. slipperiness,broken down vehicles, congestion and the like, smaller radii and shortertime intervals can be used than for data relating to substantiallyinvariable or only slowly variable route properties, such as e.g. ruts,potholes, roadworks and the like. Normally, such route data relate toboth directions of travel on a route or are capturable independently ofa direction of travel, as a result of which a direction of travel is notreconstructable by that means.

According to one aspect of the method according to the invention, routeproperties remaining substantially unaltered over a route section can betransmitted as a mean value for the section. Accordingly, the start andend of the section are transmitted instead of a single capture location.The center of the radius for delaying the transmission can be chosen atrandom within the section in this case. Alternatively, it is possible toplace the radius at the end of the section as seen in the direction oftravel. The start and end of the section may be determined by thesubstantially unaltered property. Alternatively, it is possible todivide a longer section having substantially unaltered route propertiesinto subsections for which a respective route data message of their ownis transmitted. These messages can then again be transmitted to thedatabase, according to one or more of the aspects described earlier on,in an order chronologically independent of the capture and possibly atrandom intervals.

According to one aspect of the method according to the invention, thedata are transmitted in a user data area of a message that also has aheader area as well. The message can contain a signature of the sendingvehicle. The signature may be specific to a vehicle manufacturer, or toa vehicle series of a manufacturer, but also to a single vehicle. As aresult, it is e.g. possible to make a quality distinction for the data,e.g. if different sensors having different accuracy are used forcapturing the route properties in vehicles or vehicle series ofdifferent manufacturers.

The signature can be inspected on reception in the database. If asignature is repeatedly associated with erroneous data, further datahaving this signature can be rejected immediately on reception. If thesignature is transmitted in the header area and intermediate receiversreplace it with their own respective signature, this option is lost. Inthis case, an at least partial remedy can be provided if a furthersignature that does not allow explicit identification of a singlevehicle, e.g, a signature common to all vehicles in a series from onemanufacturer, is inserted into the user data portion of the message. Inthe event of a sensor problem specific to one series, the applicablemessages can be filtered more easily.

According to one aspect of the method according to the invention, thedata in the user data area of the message are encrypted using a publickey of the database, which means that they can be decrypted only in thedatabase using the applicable private key. As a result, unauthorizedaccess to the data during the transmission, at least some of which iseffected via a wireless transmission link, of course, can be hampered.It is also possible to encrypt data according to vehicle manufacturer,which means that only the manufacturer of the vehicle that hasoriginally captured the data is capable of decrypting the data. Thisallows service differentiation between different manufacturers in thedatabase. Forwarding of the route data messages in this context can beperformed independently of the manufacturer by all vehicles set up to doso.

According to one aspect of the method according to the invention, dataare not sent directly to the database, but rather need to be forwardedvia a predetermined minimum number of other vehicles before they aresent to the database. The data can be transmitted between two vehiclesby means of vehicle-to-vehicle communication (V2V), also known ascarto-car communication (C2C). Each intermediate receiver in thiscontext poses as the origin of the data to the receiver of the routedata message transmitted by it.

In this case, it may make sense, for example in order to limit the datatraffic, but also in order to avoid an accumulation of identical routedata in the database that have been captured by one vehicle but havebeen sent by different vehicles, for captured route data to be sent bythe capturing vehicle only a single time. Expediently, on transmission,correct reception is verified, for example by means of known methods forforward error correction, and acknowledged. After an acknowledgement ofreception is obtained, the data cannot be sent again, and can be erasedif they do not need to remain stored in the vehicle for other purposes.

The header portion of the message may have a flag denoting the messageas original provided in it that cannot be transmitted directly to thedatabase. A vehicle acting as an intermediate receiver can erase theflag after reception or before forwarding, and can then send the messageto the database. Instead of the flag, a count may also be provided inthe header portion of the message, which the vehicle that has capturedthe data sets to a value and which is lowered by one by eachintermediate receiver. So long as the count for a message is not zero,this message cannot be sent directly to the database. The countaccordingly indicates how often a message needs to be forwarded beforeit can be sent to the database.

This aspect of the method according to the invention ensures, inparticular if the first sending of the message has been delayedaccording to one or more other aspects of the method according to theinvention, that reception of a message from a vehicle cannot be used toinfer that this vehicle has also been at the location of capture of theroute data. If only one intermediate receiver is provided, it is merelypossible to conclude that the vehicle that has captured the data and thevehicle that has sent the data to the database have encountered oneanother at some location. If multiple intermediate receivers areprovided, then not even this inference is possible. However, it isfundamentally possible to send captured route data to an intermediatereceiver immediately after capture.

The count prescribed by the vehicle that has captured the data may beadjustable by a user, either directly or via a general ‘privacy setting’that also influences other data and/or transmissions.

The count can also be chosen at random or automatically according totraffic density and according to the urgency of forwarding to thecentral server. When traffic density is high, more potentialintermediate receivers are present, which means that a higher count canbe set without significantly increasing the delay between capture of thedata and reception of the data in the database. Instead of a count, itis fundamentally also possible for an absolute earliest and/or latesttransmission time for forwarding to the database to be specified. Ifdata are available that have a high level of urgency, that is to sayneed to be transmitted to the database as quickly as possible, the countcan be automatically decreased.

According to one aspect of the method according to the invention, onlyone data record is ever sent to the same intermediate receiver. If thereare multiple data records in the memory of the vehicle that has capturedthe data, that is to say of the original source, and the conditions forsending are satisfied for multiple data records, it is furthermorepossible for the data record that is to be sent to be selected at randomif an order of sending is not prescribed on the basis of an urgencysorting or for other reasons. In other words, an intermediate receivercan only ever receive one set of data from a particular vehicle, but canreceive multiple sets of data from multiple vehicles. A vehicle that hasever served as an intermediate receiver for another vehicle cannot thenserve as an intermediate receiver for messages from this vehicle againbefore a waiting time has elapsed or within a radius around the locationof reception of the first message. The waiting time may be adjustable bya user, or may be dependent on the urgency of the transmission of themessage. Since the vehicles identify themselves on connection setup,transmission of multiple messages having route properties to the samevehicle within the time-out period can be prevented in a simple manner.

The above aspect can also be implemented by virtue of a transmissionbeing effected only to vehicles that are traveling in a differentdirection than the sending vehicle. The direction of travel can betransmitted on connection setup, for example as a numerical valuerepresenting a compass bearing or as a statement indicating a point ofthe compass. When there is visual contact between vehicles, e.g. withintowns, it is also possible for oncoming vehicles, vehicles ahead orturning vehicles to be detected by means of a camera and appropriateimage recognition software. Such equipment may be provided anyway, forexample in order to use a license plate to ascertain data for setup of aconnection. This implementation can be used to effectively preventmessages from being transmitted to a vehicle traveling on the same routefor some time.

When a signature of the sending vehicle is transmitted in the headerportion of the message, the receiving vehicle replaces the signaturewith its own signature, and forwards the message to the nextintermediate receiver or to the database in accordance with the settingsthat the message contains about the predetermined minimum number ofintermediate receivers. This ensures that the signature of thetransmitter forwarding the message to the central database has only avery low statistical probability of being concordant with the signatureof the actual source. The signature of the vehicle can be programmed inwhen the vehicle is delivered or licensed, for example. It is alsopossible to use the signature of the vehicle that is used for an onboardor online service manual.

According to one aspect of the method according to the invention, thesignature is verified by the receiver without the content of the messagebeing opened. The message is then forwarded only if the signature hasbeen verified successfully. Methods known from pay-TV technology can beused to block signatures that have been detected as unreliable datasources. A list of blocked signatures can be transmitted to the vehiclesand kept up to date by means of wireless transmission, for example. Inthis regard, a regional selection of signatures may be provided that istransmitted to other vehicles, which means that the number of signaturesto be blocked that need to be transmitted can be reduced. In particularsignatures frequently associated with route data messages that relate toa particular region, are incorrect or unreliable can thus be effectivelyblocked.

For data transmission between two vehicles, an ad-hoc point-to-pointconnection can be used, for example based on the IEEE 802.11 P standard.Forwarding to the vehicle-external database can be effected via knownwireless connections, for example based on the GSM (Global System forMobile communications), UMTS (Universal Mobile TelecommunicationsSystem), LTE (Long Term Evolution), or other suitable connections.

If, in addition to encryption of the user data area of the message,there is provision for encryption of the header, then this can beeffected in accordance with the known “public-private key” method usinga public key of the intermediate receiver. The intermediate receiverdecrypts the header using its private key and processes and forwards themessage in accordance with the invention. Encryption of the header toocan hamper eavesdropping by third parties further.

If multiple intermediate receivers forward a route data message beforeit is sent to the database, the number of intermediate receivers or“hops” can be used to ascertain a trust value in the database. This isbased on a larger number of hops being consistent with a correspondinglygreater probability of the message possibly having been altered on itsway from data capture to the database. This results in a lower trustvalue. Also, a message is probably also no longer very relevant after alarger number of hops. Depending on the message content, the number ofhops can thus influence the further processing in the database.

It is easy to see that features of the different aspects of the methodaccording to the invention that are described above can be combined. Forexample, there may be provision for route data messages to be forwardedto an intermediate receiver only after a waiting time has elapsed aftercapture and/or after a radius around the capture location has been left.However, it is fundamentally possible to transmit route data messages toan intermediate receiver immediately after capture of the route data. Inthis case, the predetermined radius is zero and the time interval has aduration so short that the randomly chosen time in the time interval isconsistent with immediate sending. The different variants of theencryption can also be used either for direct transmission of the routedata messages to the database or for transmission via intermediatereceivers.

An apparatus set up for performing one or more aspects of the methodaccording to the invention comprises one or more sensors for capturingthe route properties, an apparatus for determining a capture location,e.g. a satellite-assisted and/or map-based navigation system, and one ormore communication interfaces for wireless communication withvehicle-external transmitters and receivers communicatively connected toa controller. The controller comprises one or more microprocessorseffecting read or write access to volatile and nonvolatile memories. Thenonvolatile memory contains program instructions that, when executed bythe one or more microprocessors in the volatile memory, perform methodsteps for controlling the one or more sensors, the apparatus fordetermining the capture location and the communication interfaces inaccordance with one or more aspects of the method according to theinvention.

The delay in the transmission hampers creation of an exact drivingprofile, and the last transmission cannot be used to infer an exactcurrent location of the vehicle. It is merely possible to establish withcertainty that the vehicle has at some time been at the capture locationwithin a time interval that is unknown to a third party. This holds inparticular for data that are independent of a direction of travel, thatis to say temperature and precipitation, for example, but also agradient or a slope of a road. In the case of route properties thatfacilitate a reconstruction of a direction of travel, saidreconstruction is hampered in accordance with other instances of theaspects described above, e.g. by a lengthy delay, which increases theprobability of multiple journeys within the delay period, or by atransmission to the database only after multiple journeys have beenmade. The disengagement of route data from the capturing vehicle as aresult of transmission via one or more other vehicles acting as messagetransmitter further hampers the creation of a driving profile for avehicle. In this case, it is not even possible to establish withcertainty that the sending vehicle was actually once at or close to thecapture location.

BRIEF DESCRIPTION OF THE DRAWINGS

Aspects of the invention will be described below with reference to thedrawing. In the drawing:

FIG. 1 shows a schematic example of a first aspect of the methodaccording to the invention;

FIG. 2 shows a schematic depiction of a second aspect of the methodaccording to the invention;

FIG. 3 shows a schematic depiction of a third aspect of the methodaccording to the invention;

FIG. 4 shows a schematic depiction of a fourth aspect of the methodaccording to the invention;

FIG. 5 shows a schematic sequence of the transmission of messages havingroute properties in accordance with the fourth aspect of the methodaccording to the invention;

FIG. 6 shows an exemplary schematic flowchart of an aspect of the methodaccording to the invention; and

FIG. 7 shows an exemplary structure of a route data message according toone or more aspects of the method according to the invention.

DETAILED DESCRIPTION

In the figures, identical or similar elements are provided withidentical reference signs.

FIG. 1 shows a schematic example of a first aspect of the methodaccording to the invention. The figure shows a road 100 having a firstand a second junction, 102 and 104. A vehicle F travels from left toright on the road 100, indicated by the arrow in front of the vehicle F.At the position x, the vehicle captures a property of the route, that isto say of the lane on the road 100 on which the vehicle F is traveling.According to the invention, the route property and the location ofcapture are not immediately sent to a database, not shown in the figure,in a route message. Rather, the location x of capture is a center for aradius r that the vehicle F first needs to leave before the routemessage can be sent. The transmission is thus effected at some positionoutside the radius r. In the example from FIG. 1, the route messagecannot be used to infer where the vehicle F is at present, because theradius r has been chosen such that it covers branching-off roads. If atransmission shortly after the radius r has been left is assumed, thevehicle F could be at four different positions A, B, C, D at the time ofthe transmission.

FIG. 2 shows a schematic depiction of a second aspect of the methodaccording to the invention, in which a transmission to a database isdependent not on a distance from the capture location, but rather on atime that has elapsed since the capture. In FIG. 2 a), a route propertyis captured at the time t1. The time t1 simultaneously marks the startof a time interval extending to the time t2, within which thetransmission is effected at a randomly selected time t3. The selectionof the time t3 for the transmission can also be rendered dependent onfurther parameters, for example on a speed of travel, on a number ofcaptured route properties for a section of an itinerary or for a period,or the like. In FIG. 2 b), the time interval running to the time t2,within which the transmission is effected, begins not immediately theroute property is captured at the time t1, but rather at a later timet4. The time t4 may be at a stipulated interval of time from the timet1. As fundamentally for other aspects of the method according to theinvention, the interval may also be dependent on further parameters,e.g. on the arrival at a distance from the capture location, on adensity of roads within a radius around the capture location, on anaverage speed of travel before and/or after the capture, or the like.The density of roads can be established easily using a combination ofposition determination and matching against a map indicating whether thevehicle is inside or outside a town. It is also possible to have theperiod for transmission begin after a distance or time condition hasbeen satisfied, depending on which condition is satisfied first.Alternatively, the period can begin on capture, but the transmission isnot effected until the radius around the capture location has been left,or, if the radius has not been left in time, at the end of the period.As described above with reference to FIG. 2 a), the transmission iseffected at a time t3 selected at random or according to a rule withinthe time interval t4-t2.

FIG. 3 shows a schematic depiction of a third aspect of the methodaccording to the invention that can be used when multiple routeproperties have been captured in brief succession. At the time t1, afirst route property is captured. The time t1 simultaneously marks thestart of a time interval t1-t2 within which the first route property istransmitted to the database. At the time t3, a second route property iscaptured. The time t3 simultaneously marks the start of a time intervalt3-t4 within which the second route property is transmitted to thedatabase. Since the time at which the route property is transmitted tothe database is selected at random, the second route property can betransmitted before the first route property is transmitted. In thisexample, the second route property is transmitted at the time t5, andthe first route property at the time t6. This example accordingly alsoshows the order of transmission to the database, which is independent ofthe order of capture. The order of the transmissions, which isindependent of the chronological order of the captures, can at leasthamper the reconstruction of a direction of travel for a single journey,depending on the type of route properties and the number oftransmissions.

FIG. 4 shows a schematic depiction of a fourth aspect of the methodaccording to the invention. In the case of this aspect, a transmissionto the database is effected not directly by the vehicle that hascaptured the route property, but rather via one or more intermediatereceivers. Multiple vehicles F1-F7 are traveling on a first road 100 andon roads 102 and 104 branching off from the first road 100. The firstvehicle F1 has captured a route property at its current position. Sincea direct transmission to the database is impossible according to theinvention, a message having the route properties must first of all besent to another vehicle in communication range. In the example shown inthe figure, the vehicles F2 to F6 are in communication range of vehicleF1, indicated by the circle centered around the vehicle F1.

FIG. 5 shows a schematic sequence of the transmission of messages havingroute properties in accordance with the fourth aspect of the methodaccording to the invention already presented with reference to FIG. 4. Afirst vehicle F1 captures route data, and stores them in avehicle-internal memory. At a later time, a second vehicle F2 comes intocommunication range of the first vehicle F1. If any conditions to beobserved for the sending of the data are satisfied, that is to say, byway of example, a radius around the capture location has been left, ordata that need to be transmitted particularly urgently are available,the first vehicle F1 initiates setup of a connection to the secondvehicle F2 by sending a connection request. If the second vehicleresponds positively to the connection request, then further steps forpreparing to transmit the data can follow. During setup of theconnection, it is possible for not only information required for settingup a transmission channel but also further information to betransmitted, which is used to decide whether route data can betransmitted to the second vehicle. As such, by way of example, adirection of travel of the second vehicle F2 can be taken intoconsideration, or whether the second vehicle has already served as anintermediate receiver for a transmission by the first vehicle, and awaiting time conditional thereon has not yet elapsed. If route data canbe transmitted to the second vehicle, the first vehicle sends them withits signature. The second vehicle verifies the signature and replaces itwith its own signature if the result of the verification is positive.The second vehicle then transmits the route data to the database or to afurther intermediate receiver, possibly after further conditions to betaken into consideration before the transmission to the database havebeen satisfied.

FIG. 6 shows an exemplary schematic flowchart of an aspect of the methodaccording to the invention. In step 602, a vehicle, not depicted in thefigure, captures route data, and stores them in a vehicle-internalmemory in step 604. In step 606, a check is performed to determinewhether there are more than two data records in the vehicle-internalmemory. If not, “no” branch from step 606, further data are captured andstored. If there are, “yes” branch from step 606, a check is performedin step 608 to determine whether further pre-conditions are satisfiedthat are necessary for sending. If not, “no” branch from step 608,sending is delayed until the conditions are satisfied. If the conditionsare satisfied, “yes” branch from step 608, a check is performed in step610 to determine whether an intermediate receiver is in communicationrange. The check is performed until an intermediate receiver is incommunication range. If another vehicle is in communication range thatcan serve as an intermediate receiver, “yes” branch from step 610, acommunication connection is set up in step 612, and the data aretransmitted in step 614. It should be pointed out that the flowchartshown in FIG. 6 reproduces the sequence of the method only by way ofexample. Certain parts of the method can proceed in parallel, and alsobe called again by a subsequent step in the flowchart. As such, by wayof example, new data can be captured and stored while, in anothersubarea of the method, a check is performed to determine whethernecessary conditions for transmission are satisfied, and the presence ofthe conditions for a transmission can be inspected again if anintermediate receiver is in communication range.

FIG. 7 shows an exemplary structure of a route data message 700 for useaccording to one or more aspects of the method according to theinvention. The route data message is split into a header area 702 and auser data area 704. The header area is further split into an addressarea 706, a counter area 708 and a signature area 710. One or morefurther areas 712 for further data, the arrangement of which in theheader area 702 is advantageous, may additionally be provided. Theaddress area 706 can be used to transmit the origin and/or destinationaddress of the data packet. Moreover, an address of the intermediatereceiver can be transmitted at this point. Some of the addresses, inparticular those allowing the message to be explicitly linked to avehicle that has captured the user data of the message, can be changedby the intermediate receiver. The counter area 708 can transmit a countindicating via how many intermediate receivers the message still needsto be sent before it can be sent to the database, and/or an absolutetime after which, when said time is reached, the message can be sent tothe database. The signature area 710 contains a signature of thetransmitter, which is inspected by the receiver before the message isforwarded. The address of the transmitter can also be used for theinspection. In the event of successful inspection and a positive result,the intermediate receiver replaces the signature and possibly the senderaddress with its own signature and address before the message isforwarded. The arrangement of the addresses, of the counter and of thesignature in the header area 702 of the route data message allows theuser data to be encrypted using a public key of the database, so thatthe actual content of the route data message cannot be decrypted untilafter reception in the database. This permits the route data to bedifferentiated, e.g. according to the manufacturer of the vehicle thathas captured the data. As such, by way of example, a vehicle from onemanufacturer can encrypt the data using a public key of a particulardatabase providing services only for vehicles from this manufacturer,and the data can nevertheless be transmitted to the database viavehicles from any other manufacturers as intermediate receivers.

1. A method for transmitting route data captured by a traveling vehicleto a database arranged separately from the vehicle, comprising:capturing at least a first number of route data records, wherein a routedata record comprises route data and also a location and a time ofcapture, and storing the captured route data records in a memory of thevehicle; and sending route data messages to the database when at leastthe first number of data records is available in the memory, wherein aroute data message comprises route data and an associated location ofcapture, a route data message being sent at a time randomly selectedwithin a first time interval after the capture of the route data and/orwhen the vehicle has left a predetermined radius around the location ofcapture of the route data.
 2. The method as claimed in claim 1, whereinif the first number is greater than one, route data messages comprisingroute data and the associated location of capture are sent in a firstorder.
 3. The method as claimed in claim 2, wherein the first order is arandom order independent of the chronological order of capture.
 4. Themethod as claimed in claim 2, wherein two successive transmissions ofroute data messages are effected at a randomly selected interval oftime.
 5. The method as claimed in claim 1, wherein a statement about aperiod within which the route data have been captured is transmitted inthe route data message.
 6. The method as claimed in claim 1, wherein theradius and/or the first time interval are determined on the basis of theurgency of the transmission of the route data, an average speed oftravel of the vehicle around the time of the capture or a minimum numberof road junctions within the radius, or are adjustable by a user.
 7. Themethod as claimed in claim 1, wherein route data and location of captureare transmitted in a user data area of a message, and wherein a headerof the message contains a signature of the sending vehicle.
 8. Themethod as claimed in claim 7, wherein the user data area of the messageis encrypted using a public key of the database.
 9. The method asclaimed in claim 7, wherein the message from the capturing vehicle isfirst of all transmitted to another vehicle, the other vehicle replacingthe signature of the sending vehicle in the header of the message withits own signature before the message is transmitted to the database. 10.The method as claimed in claim 9, wherein the receiving vehiclevalidates the signature of the sending vehicle.
 11. The method asclaimed in claim 9, wherein the message contains a feature identifyingit as a forwarded message or as an original message.